Protecting network devices from suspicious communications

Patent metadata

Field	Value
Publication number	US-10243979-B2
Application number	US-201615040670-A
Country	US
Kind code	B2
Filing date	Feb 10, 2016
Priority date	Feb 11, 2015
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

According to some aspects, disclosed methods and systems may comprise generating a profile that is based on monitoring a communication pattern associated with a device. Subsequent communications associated with the device may be monitored. Based on the profile and the subsequent communication, a security status may be associated with the device.

First claim

The invention claimed is:

1. A method comprising:
generating, by a computing device and based on monitored communication associated with a first device at a first time, a profile of expected communication behavior for the first device, wherein the first device is associated with a first network;
determining, based on the profile and based on monitored communication associated with the first device at a second time, a degree of communication deviation associated with the first device;
comparing the degree of communication deviation with a plurality of different deviation ranges, wherein each of the deviation ranges is associated with one or more corresponding communication parameters; and
causing, based on the comparing, application of one or more communication parameters to communication of the first device.

2. The method of claim 1 , further comprising:
determining, from a plurality of communication parameters, a first communication parameter based on the degree of communication deviation being within a first deviation range,
wherein the first communication parameter has fewer restrictions than a second communication parameter associated with a second deviation range.

3. The method of claim 2 , further comprising:
determining, based on another monitoring of communication associated with the first device, a second degree of communication deviation within the second deviation range; and
causing, based on the second degree of communication deviation, application of the second communication parameter to communication of the first device.

4. The method of claim 3 , further comprising updating, based on the second degree of communication deviation, the profile.

5. The method of claim 1 , further comprising:
determining, based on another monitoring of communication associated with the first device, a second degree of communication deviation;
associating, based on the second degree of communication deviation, the first device with a different security status; and
causing, based on the different security status, application of one or more different communication parameters to communication of the first device, blocking communication to or from the first device, or allowing communication to or from the first device.

6. The method of claim 1 , further comprising:
determining a communication attempt from a second device to the first device;
evaluating a security status associated with the second device; and
restricting, based on the evaluated security status and on the applied one or more communication parameters, communication associated with the communication attempt.

7. The method of claim 1 , wherein the generating the profile is further based on one or more of:
a packet size associated with communication to or from the first device; or
timing information associated with communication to or from the first device.

8. The method of claim 1 , wherein the determining degree of communication deviation is further based on different weights for a plurality of communication deviation types associated with the first device.

9. The method of claim 1 , further comprising:
setting, based on determining that a sensor type of a second device corresponds to a sensor type of the first device, a security status of the second device by using the profile of expected communication behavior for the first device.

10. A method comprising:
generating, based on monitored communication between a first device and a second device via a network, a profile of expected communication behavior for the first device;
determining, based on the profile and based on monitored subsequent communication associated with the first device, a degree of communication deviation;
comparing the degree of communication deviation with a plurality of different deviation ranges, wherein each of the deviation ranges is associated with one or more corresponding communication parameters;
causing, based on the comparing, application of one or more communication parameters to communication of the first device; and
controlling, based on the application, network access associated with the first device.

11. The method of claim 10 , wherein the applied one or more communication parameters comprises one or more of:
a restriction on a packet size transmitted from the first device;
a restriction on a communication time for the first device;
a restriction on a communication attempt from the first device to another device; or
a restriction on a communication attempt from another device to the first device.

12. The method of claim 10 , wherein the controlling network access comprises:
restricting communication associated with a device that is not on a list of approved devices.

13. The method of claim 10 , wherein the second device is associated with a second network external to the network.

14. The method of claim 12 , wherein the controlling network access comprises:
allowing communication associated with a device that is on the list of approved devices.

15. The method of claim 10 , wherein the controlling network access comprises restricting communication associated with a device that is on a list of approved devices.

16. A method comprising:
generating, by a computing device:
a first profile of expected communication behavior for a first device associated with a network; and
a second profile of expected communication behavior for a second device;

monitoring:
communication associated with the first device; and
communication associated with the second device;

determining, based on the first profile and based on the monitored communication associated with the first device, a first degree of communication deviation associated with the first device, wherein the first degree is within a first range;
determining, based on the second profile and based on the monitored communication associated with the second device, a second degree of communication deviation associated with the second device, wherein the second degree is within a second range different from the first range; and
causing, based on the first degree and the second degree, application of one or more communication parameters to communication between the first device and the second device.

17. The method of claim 16 , wherein a degree of communication deviation within the second range is greater than a degree of communication deviation within the first range.

18. The method of claim 16 , further comprising:
determining, based on another monitoring of communication associated with the second device, a third degree of communication deviation within the first range; and
causing, based on the third degree of communication deviation within the first range, application of one or more different communication parameters to communication between the first device and the second device.

19. The method of claim 16 , further comprising:
determining a first communication attempt from the second device to the first device;
blocking communication associated with the first communication attempt;
determining, based on another monitoring of communication associated with the second device, a third degree of communication deviation within the first range;
determining a second communication attempt from the second device to the first device; and
allowing, based on a combination of the first degree of communication deviation and the third degree of communication deviation, communication associated with the second communication attempt.

20. The method of claim 16 , further comprising:

Assignees

• Comcast Cable Comm Llc

Inventors

• Poder James
• Francisco Mark D

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title